1 /* 2 * Decoder of socket filter programs. 3 * 4 * Copyright (c) 2017 Dmitry V. Levin <ldv (at) altlinux.org> 5 * Copyright (c) 2017-2018 The strace developers. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of the author may not be used to endorse or promote products 17 * derived from this software without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 #include "defs.h" 32 33 #include "bpf_filter.h" 34 35 #include <linux/filter.h> 36 #include "xlat/skf_ad.h" 37 #include "xlat/skf_off.h" 38 39 static bool 40 print_sock_filter_k(const struct bpf_filter_block *const fp) 41 { 42 if (BPF_CLASS(fp->code) == BPF_LD && BPF_MODE(fp->code) == BPF_ABS) { 43 if (fp->k >= (unsigned int) SKF_AD_OFF) { 44 print_xlat32(SKF_AD_OFF); 45 tprints("+"); 46 printxval(skf_ad, fp->k - (unsigned int) SKF_AD_OFF, 47 "SKF_AD_???"); 48 return true; 49 } else if (fp->k >= (unsigned int) SKF_NET_OFF) { 50 print_xlat32(SKF_NET_OFF); 51 tprintf("+%u", fp->k - (unsigned int) SKF_NET_OFF); 52 return true; 53 } else if (fp->k >= (unsigned int) SKF_LL_OFF) { 54 print_xlat32(SKF_LL_OFF); 55 tprintf("+%u", fp->k - (unsigned int) SKF_LL_OFF); 56 return true; 57 } 58 } 59 60 return false; 61 } 62 63 void 64 print_sock_fprog(struct tcb *const tcp, const kernel_ulong_t addr, 65 const unsigned short len) 66 { 67 print_bpf_fprog(tcp, addr, len, print_sock_filter_k); 68 } 69 70 void 71 decode_sock_fprog(struct tcb *const tcp, const kernel_ulong_t addr) 72 { 73 decode_bpf_fprog(tcp, addr, print_sock_filter_k); 74 } 75
